Lucky98 Privacy Policy — How We Handle Your Data

This Privacy Policy applies to lucky98.biz — an online gaming platform operated for and primarily serving players in Pakistan. When we say "lucky98", "we", "us", or "the platform" in this document, we are referring to the operator of lucky98.biz and all services available through it.

Lucky98 acts as the data controller for personal information collected through lucky98.biz. This means we determine the purposes for which your personal data is collected and the manner in which it is processed. We take that responsibility seriously. Your data is never an afterthought at lucky98 — it is something we handle with the same care and discipline as your financial transactions.

If you have any question about this Privacy Policy or how lucky98 handles your personal information, you can reach us at support@lucky98.biz at any time. Our support team is available 24 hours a day, seven days a week, in English and Urdu.

Lucky98 collects personal data only to the extent necessary to provide you with a functioning, secure, and personalised gaming experience. The following table sets out the categories of data we collect and the circumstances in which each is collected.

Data collected by lucky98 is used for specific, defined purposes. We do not process your personal information for any purpose not listed here without obtaining your explicit consent first.

Primary Purposes:

• Account Management: Creating, maintaining, and operating your lucky98 account — including processing logins, managing your balance, and keeping your account settings up to date.
• Transaction Processing: Processing PKR deposits and withdrawals through Easypaisa, JazzCash, NayaPay, SadaPay, bank IBFT, and card payments. Financial data is used solely to complete the transaction you have requested.
• Identity Verification (KYC): Verifying your identity in compliance with anti-money laundering obligations. KYC checks protect all players by ensuring the platform is not misused for financial crime.
• Customer Support: Using your account information and communication history to resolve queries, disputes, and technical issues efficiently and accurately.
• Fraud and Security: Monitoring account activity for patterns consistent with fraud, multi-accounting, money laundering, or other prohibited conduct. This protects all lucky98 players.
• Responsible Gaming: Using account activity data to identify patterns that may indicate harmful gambling behaviour, and to apply limits, cooling-off periods, or self-exclusion as requested or required.

Secondary Purposes (only with your consent where required):

• Marketing Communications: Sending you bonus offers, promotions, and platform news via SMS or email. You can opt out of marketing communications at any time through your account settings or by contacting support.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve lucky98's features, performance, and game catalogue. This data cannot be used to identify individual players.
• VIP Programme Personalisation: Using your gaming history and VIP tier information to offer personalised bonuses, promotions, and recommendations relevant to your actual play preferences.

Every processing activity carried out by lucky98 is grounded in one of the following legal bases. Where the legal basis is consent, you can withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

• Contractual Necessity: Processing required to fulfil our obligations under the lucky98 Terms and Conditions — including account operation, payment processing, and customer support. Without this processing, we cannot provide the service.
• Legal Obligation: Processing required by applicable law — including KYC verification, anti-money laundering screening, and transaction record-keeping obligations.
• Legitimate Interests: Processing carried out for fraud prevention, platform security, and aggregated analytics where our interest in protecting the platform and its players is balanced against your privacy interests.
• Consent: Marketing communications and optional personalisation features are processed only with your explicit consent, given freely at registration or through your account settings at any time.

Lucky98 does not sell, rent, or commercially trade your personal data. Full stop. Data sharing at lucky98 is limited to what is operationally necessary or legally required. The following categories of third parties may receive limited data access.

• Payment Processors: Easypaisa, JazzCash, NayaPay, SadaPay, and banking partners receive only the transactional data required to process your specific deposit or withdrawal. They do not receive your gaming history, identity documents beyond what their own KYC requires, or account details beyond the transaction reference.
• Game Providers: Third-party game studios that supply lucky98's slots, live casino, and other games may receive a pseudonymous player reference to enable game functionality and resolve disputes. They do not receive your real name, CNIC, or financial details.
• Technology Service Providers: Hosting, security, and analytics vendors who process data solely on lucky98's behalf under strict contractual data processing agreements. They may not use your data for any purpose other than providing their service to lucky98.
• Law Enforcement & Regulatory Authorities: Lucky98 will disclose personal data to law enforcement, regulatory, or judicial bodies when legally compelled to do so by valid legal process. We will notify you of such requests where legally permitted.

• Lucky98 does NOT sell your personal data to advertising networks, data brokers, or any commercial third party.
• Lucky98 does NOT share your data with other gaming platforms or operators.
• Lucky98 does NOT share your CNIC information with any third party not directly involved in legally required KYC verification.

Security is not an area where lucky98 cuts corners. The following measures are in place across the platform and reviewed regularly by our in-house security team and independent external auditors.

Data sensitivity vs. security level applied:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and lucky98's servers is encrypted. Any attempt to intercept data in transit would yield only unreadable cipher text.
• Penetration Testing: Lucky98 commissions independent penetration tests at minimum twice per year. Any vulnerabilities identified are remediated before the test report is finalised.
• Two-Factor Authentication: 2FA is available on all lucky98 accounts and strongly recommended. Enabling it ensures that access to your account requires both your password and a one-time code sent to your registered mobile number.
• Access Controls: Lucky98 staff can only access player data relevant to their specific function. Financial data is accessible only to authorised personnel in the payments team. Identity documents are handled exclusively by the KYC function.
• Breach Response Plan: Lucky98 maintains a documented data breach response plan. In the event of any confirmed breach affecting player data, affected players will be notified by email within 72 hours of the breach being confirmed, along with guidance on protective steps to take.

Lucky98 retains personal data only for as long as is necessary for the purpose it was collected or as required by applicable law. The following retention periods apply.

• Active Account Data: Retained for the duration of your active membership on lucky98, plus a period of five years following account closure to satisfy transaction record-keeping obligations.
• KYC / Identity Documents: Retained for five years following account closure in compliance with anti-money laundering regulations. These documents are securely deleted at the end of the retention period.
• Transaction Records: All financial transaction records are retained for seven years following the transaction date. This is a standard financial record-keeping requirement.
• Support Communications: Customer support conversations are retained for three years following resolution of the relevant query, to allow accurate reference in the event of future related queries or disputes.
• Marketing Preferences: Retained until you withdraw consent. Withdrawing marketing consent does not affect other account data and does not close your account.

Lucky98 uses cookies and similar tracking technologies to operate the platform, remember your preferences, and understand how players use the site. Here is a plain-language breakdown of what we use and why.

• Essential Cookies: Required for the platform to function — login sessions, security tokens, and language preferences. These cannot be disabled without breaking core functionality. They contain no personally identifiable information beyond a session reference.
• Performance Cookies: Anonymised data about how players navigate lucky98 — which pages are visited most, where players encounter issues, and how long sessions last. This data is used exclusively to improve the platform and cannot be used to identify individual players.
• Preference Cookies: Remember your game preferences, notification settings, and display choices so you do not need to reset them on each visit. These are optional and can be cleared via your browser at any time.
• Lucky98 does NOT use advertising cookies, Facebook Pixel, Google Ads tracking, or any third-party remarketing cookies that track your activity across other websites.

As a lucky98 player, you have clear rights over your personal data. Lucky98 is committed to honouring these rights fully and promptly. To exercise any of the rights below, contact us at support@lucky98.biz with the subject line "Privacy Rights Request" and your account username.

Lucky98 is strictly a platform for adults aged 18 and over. We do not knowingly collect, use, or retain personal data from anyone under the age of 18.

• Age verification checks are conducted on all new lucky98 accounts. Registration requires confirmation that the applicant is 18 or older.
• Where lucky98 identifies or is notified that an account was registered by someone under 18, the account will be immediately closed, all deposits returned to the original payment source, and all personal data associated with the account securely deleted.
• If you believe a minor has accessed or registered on lucky98, please notify us immediately at support@lucky98.biz. We will investigate and act within 24 hours of receiving such a report.

Lucky98 reviews and updates this Privacy Policy periodically to reflect changes in our data practices, legal requirements, or platform features. Here is how we handle those updates.

• Material changes — those that meaningfully affect what data we collect or how we use it — will be communicated to all registered players by email at least 14 days before the changes take effect.
• Non-material changes — such as clarifications, corrections, or updates to contact information — will be applied without advance notice. The "Last Updated" date at the top of this page will always reflect the current version.
• Continued use of lucky98 after the effective date of an updated Privacy Policy constitutes your acceptance of the updated terms. You may close your account and request data deletion at any time if you do not wish to continue under updated terms.
• The current, binding version of this Privacy Policy is always the version published at lucky98.biz/privacy-policy. Earlier versions are superseded immediately upon publication of a new version.

All privacy-related requests, questions, and complaints are handled by the lucky98 support team. We take data privacy concerns very seriously and commit to responding to all privacy queries within 48 hours.

• Email: support@lucky98.biz — For formal privacy rights requests, data deletion requests, and data breach notifications. Use the subject line "Privacy Request" along with your account username.
• Live Chat: Available 24/7 within your logged-in lucky98 account, in English and Urdu. Best for general privacy questions that do not require formal documentation.
• FAQ: Our lucky98 FAQ covers the most common questions about data, privacy, and account security. Many queries are answered there without needing to contact support directly.